Kazakhstan State Auditor Certification cheat sheet

Constitutional basis: the Constitution of the Republic of Kazakhstan establishes state audit as control over the use of budget funds and state assets; the Supreme Audit Institution is the Accounts Committee for Control over Execution of the Republican Budget (Высшая аудиторская палата).

Hierarchy of norms: Constitution → Budget Code → Law on State Audit and Financial Control → subordinate acts (rules, standards) of the authorized body; a lower act that conflicts with the Budget Code does not apply.

Law on State Audit and Financial Control distinguishes external state audit (conducted by Accounts Committee and audit commissions of oblasts/cities of republican significance) from internal state audit (authorized body for internal state audit and its territorial units).

Types of state audit activity: state audit (audit of efficiency, compliance) and financial control (control over budget execution, use of state grants and assets); the Law defines audit measures versus control measures.

Objects of state audit include state bodies, state institutions, quasi-public sector entities, recipients of budget funds, and legal entities in which the state holds a controlling share or golden share.

Accounts Committee is accountable to the President and reports to Parliament; audit commissions of regions are accountable to local representative bodies (maslikhats) and report to them, ensuring external independence from the audited executive.

Financial control powers include issuing binding instructions (предписания), initiating administrative liability, and referring materials to law-enforcement and prosecution bodies where violations with criminal signs are found.

Independence and ethics requirements are codified: auditors must be free of conflict of interest, declare affiliations, and are subject to anti-corruption restrictions under the Law on Combating Corruption.

Budget cycle stages: drafting → review and approval by Parliament/maslikhat → execution → accounting and reporting → external state audit → evaluation of results; each stage has statutory deadlines in the Budget Code.

Budget system levels: republican budget, oblast budgets, budgets of cities of republican significance and the capital, and district/city budgets; intergovernmental transfers (transfers, subventions, budget loans) balance them.

Budget classification is unified and includes functional, departmental, economic, and program classification; expenditure is programmed by budget programs with performance indicators.

Budget programs carry performance indicators (direct results, final results, quality indicators); audit of efficiency tests whether indicators were achieved at lowest cost or whether results justify spending.

Budget execution uses the treasury single account (казначейство); cash plan (кассовый план) governs monthly liquidity; deviations between plan and cash execution are an audit trigger.

State debt and guarantees: borrowing limits set in the budget law; audit verifies compliance with the debt ceiling and evaluates cost of borrowing and guarantee exposure.

Reserve of the Government and local executive reserves are spent only on purposes defined by budget law; audit tests legality of reserve spending and absence of double funding.

Unused budget funds and non-compliance with budget legislation can trigger return of funds, reduction of financing, and administrative liability under the Budget Code and Code of Administrative Offences.

Audit process phases: pre-study (предварительное изучение) → planning → audit engagement (audit measure) → reporting → follow-up on recommendations; each phase produces documented outputs.

Standards framework: state audit standards approved by the authorized body and the Accounts Committee; methodology aligns with INTOSAI ISSAI principles (ISSAI 100-4000) without being identical to them.

Two audit types: audit of compliance (legality, targeted and effective use) and audit of efficiency (economy, efficiency, effectiveness); performance audit uses criteria derived from law, plans, and best practice.

Audit criteria must be verifiable, relevant, and communicated to the audited entity; findings are stated as condition vs. criteria with cause and effect (the four-element finding model).

Risk-based selection determines which objects and budget programs enter the audit portfolio; the audit program defines scope, objectives, questions, methods, and timeline.

Working papers must allow an experienced auditor with no connection to the audit to understand what was done, what evidence was obtained, and how conclusions were reached.

Materiality in state audit is both quantitative (threshold of budget funds) and qualitative (public interest, social significance, corruption risk); qualitative factors can make a small amount material.

Quality control: internal review by a senior auditor and, where required, independent quality review before the report is signed; unresolved disagreements are documented.

Audit risk = inherent risk × control risk × detection risk; the auditor reduces detection risk through more extensive substantive testing.

Inherent risk drivers in the public sector: complexity of program, volume of funds, history of violations, changes in legislation, new programs, and procurement intensity.

Control risk is assessed by testing design and implementation of internal controls; weak controls raise the planned level of substantive procedures.

Materiality thresholds are set at planning and revised if new information emerges; the benchmark is usually a percentage of budget program expenditure or total assets audited.

Sampling plan is derived from materiality and risk: higher risk and lower tolerable misstatement require larger sample size and more stratification.

Planning documentation includes the audit strategy (objectives, scope, resources, timeline) and the audit program (detailed procedures, responsible persons).

Risk register links identified risks to audit questions and procedures; each significant risk must map to at least one planned procedure.

Follow-up risk: prior-period recommendations not implemented raise the risk rating of the object and justify re-inclusion in the audit plan.

Sufficient and appropriate evidence: sufficiency = quantity, appropriateness = relevance and reliability; reliability order: auditor's direct observation > external confirmation > internal documents > oral statements.

Evidence-gathering methods: inspection, observation, inquiry, confirmation, recalculation, re-performance, and analytical procedures; triangulation of two independent sources strengthens a finding.

Sampling types: statistical (random, systematic with random start) and non-statistical (judgmental); the sampling unit and population must be defined before selection.

Projected misstatement in a sample is extrapolated to the population; sampling risk is the risk that the conclusion based on the sample differs from the conclusion on the whole population.

Analytical procedures: trend analysis, ratio analysis, comparison with prior periods and with comparable entities; significant unexplained fluctuations are investigated as audit questions.

Documentary evidence from treasury and procurement portals (goszakup) is machine-readable; reconciliation of contracts, payment orders, and acceptance acts detects mismatches.

Evidence must be documented with source, date, preparer, and cross-reference to the working paper; undocumented evidence is not usable in the report.

When evidence conflicts, the auditor obtains additional evidence rather than averaging; unresolved contradictions are disclosed in the report.

Report structure: brief summary, scope and objectives, criteria, findings (condition, criteria, cause, effect), conclusions, and recommendations with responsible person and deadline.

Findings must be supported by evidence cross-referenced to working papers; the audited entity's objections are reviewed and either accepted with amendment or rebutted with reasons.

Recommendations must be specific, measurable, achievable, and addressed to a named body; generic recommendations are not accepted by methodology standards.

The report is submitted to the audited entity, superior body, and where required to Parliament or maslikhat; confidentiality and state-secret rules apply to restricted content.

Follow-up: the audited entity reports on implementation within the deadline; the auditor verifies implementation with documentary evidence, not with the entity's statement alone.

Non-implementation of recommendations can lead to repeated audit, administrative liability, or referral to law-enforcement bodies.

Quantified effect of violations (unjustified spending, lost budget revenue, inefficient use) is stated in tenge with the calculation method disclosed.

Public disclosure of audit results is a statutory principle; the report and summary may be published unless it contains restricted information.

Procurement methods under the Law on Public Procurement: open tender, auction, request for quotations, single-source, and electronic shop; method choice depends on subject and threshold.

Key thresholds and rules are set in the Law on Public Procurement and annual budget law; single-source procurement requires a documented legal ground.

Procurement audit tests: justification of need, correct method, publication of the announcement, qualification criteria, bid evaluation, and contract award within the announced terms.

Contract execution tests: compliance with delivery terms, acceptance acts, price changes (only within statutory limits), and penalties for delay.

State asset management: inventory of state property, register of state assets, transfer and privatization rules; audit tests legality of disposal and completeness of the register.

Quasi-public sector entities are subject to procurement rules and audit; state share participation creates procurement and asset-management obligations.

Conflict of interest in procurement (affiliation of commission members with bidders) is a corruption risk and a frequent audit finding.

Inefficient procurement (higher price than market, unnecessary volume) is an efficiency audit finding even when the procedure was formally legal.

Public sector accounting follows the Law on Accounting and IFRS as adopted in Kazakhstan; state institutions apply the chart of accounts for state institutions.

Budget reporting forms and deadlines are set by the authorized body; annual financial statements are audited externally by state audit bodies.

Internal control components: control environment, risk assessment, control activities, information and communication, monitoring (COSO model adapted to the public sector).

Segregation of duties, authorization, documentation, physical control, and reconciliation are core control activities; absence of segregation is a control deficiency.

Internal audit service in a state body evaluates internal control, risk management, and governance; it reports to the head of the body and is independent of operational units.

Accounting errors and misstatements are classified by nature (error vs. fraud) and by effect (material vs. immaterial); material misstatements require correction and disclosure.

Cash and non-cash budget execution is recorded in the treasury system; reconciliation between the entity's accounting and treasury data is a standard audit procedure.

Internal control deficiencies are reported with severity (deficiency vs. significant deficiency vs. material weakness) and linked to the risk they create.

Ethical principles for state auditors: integrity, objectivity, confidentiality, professional competence, and compliance with law; codified in the Law on State Audit and the anti-corruption law.

Independence has two dimensions: organizational (reporting line, tenure, budget) and individual (no personal or financial interest in the audited entity).

Conflict of interest must be declared and managed; an auditor with a close relative in the audited entity's management is recused from the audit.

Anti-corruption restrictions include bans on gifts, on using official position for private gain, and on business interests incompatible with the position.

Confidentiality: audit information is disclosed only as provided by law; unauthorized disclosure is a disciplinary and possibly criminal offence.

Whistleblowing and anti-corruption compliance: state bodies must have prevention measures, and auditors report corruption signs to authorized bodies.

Accepting hospitality or benefits from audited entities is prohibited; even the appearance of dependence undermines the audit conclusion.

Disciplinary liability for ethics breaches includes reprimand, dismissal, and referral to law enforcement where corruption signs exist.

Computer-assisted audit techniques (CAAT): data extraction, matching, duplicate detection, gap analysis, and Benford's law testing on procurement and payment data.

Data sources for state audit: treasury information system, state procurement portal, tax and customs databases, and the state asset register; access is governed by law.

Data reliability checks before analysis: completeness, accuracy, consistency, and reconciliation of totals with source reports; unreliable data invalidate the conclusion.

Audit documentation standards require working papers to be indexed, dated, signed, and retained for the statutory retention period; electronic papers must be protected from alteration.

Audit management information systems support planning, working papers, review, and reporting; access rights and audit trails are themselves a control.

IT general controls (access, change management, backup, business continuity) are assessed when audit evidence comes from an information system.

Data analytics findings must be validated against source documents before being reported; a data anomaly is an audit question, not yet a finding.

Personal data processing during audit must comply with the Law on Personal Data and Its Protection; data minimization applies.